MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 72d494f6c9a48cfaf5a6fcceb97b98cb83c38a73235d7b87eb84d2c4e9e0df4b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 4


Intelligence 4 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 72d494f6c9a48cfaf5a6fcceb97b98cb83c38a73235d7b87eb84d2c4e9e0df4b
SHA3-384 hash: 74759eb06e31a8beb886cb42c8cb83c9d65fbfc37a84e43575f13e253e432b3308c4c35dd7bad1d8a51752a84749d530
SHA1 hash: accea060436d2dd24ce121d3cd07dbf9876e9e0f
MD5 hash: c9bebf0b8688ccef820e4c25113489f2
humanhash: three-virginia-eight-two
File name:nhhgpnb5.dll
Download: download sample
File size:3'072 bytes
First seen:2025-12-23 10:21:22 UTC
Last seen:Never
File type:DLL dll
MIME type:application/x-dosexec
imphash dae02f32a21e03ce65412f6e56942daa (123 x YellowCockatoo, 60 x CobaltStrike, 44 x JanelaRAT)
ssdeep 24:etGSUWJOJ9a8tMcin5dU+atkZfe9/hzWI+ycuZhNwakScPNnqI:6UlvBtMcs5++NJe9pK1ulwa3MqI
TLSH T153510E17A3E8466BE8A703316DF387577774FC50AF72A32D1880422C9C657681E32BB0
TrID 35.4% (.EXE) Win64 Executable (generic) (10522/11/4)
22.1% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
15.1% (.EXE) Win32 Executable (generic) (4504/4/1)
6.9% (.ICL) Windows Icons Library (generic) (2059/9)
6.8% (.EXE) OS/2 Executable (generic) (2029/13)
Magika pebin
Reporter JAMESWT_WT
Tags:92-118-170-185 coinmarketcaps-cfd dll

Intelligence

File Origin
# of uploads :
1
# of downloads :
88
Origin country :
IT IT
Vendor Threat Intelligence
No detections
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/45830/
Verdict:
Clean
Score:
99.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=694a6d57a6c88bb4cc23f46d
Tags:
n/a
Verdict:
Unknown
Threat level:
  2.5/10
Confidence:
100%
Link:
https://www.filescan.io/uploads/694a6d56e126b9ff438e1957/reports/deadb3a2-e9ab-47ce-99bd-0c84746fa0af/overview
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/72d494f6c9a48cfaf5a6fcceb97b98cb83c38a73235d7b87eb84d2c4e9e0df4b
Verdict:
Clean
File Type:
executable.pe.32.dll
Link:
https://opentip.kaspersky.com/72d494f6c9a48cfaf5a6fcceb97b98cb83c38a73235d7b87eb84d2c4e9e0df4b/results?tab=lookup
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/8bf33d6d-650f-4a80-bea0-cee31ce1199f
Score:
34%
Verdict:
Susipicious
File Type:
PE
Link:
https://malprob.io/report/72d494f6c9a48cfaf5a6fcceb97b98cb83c38a73235d7b87eb84d2c4e9e0df4b
Verdict:
inconclusive
YARA:
6 match(es)
Tags:
.Net Executable Managed .NET PE (Portable Executable) PE File Layout SOS: 0.00 Win 32 Exe x86
Link:
https://app.malva.re/file/c9bebf0b8688ccef820e4c25113489f2
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/72d494f6c9a48cfaf5a6fcceb97b98cb83c38a73235d7b87eb84d2c4e9e0df4b/
Verdict:
Clean
Link:
https://tip.neiki.dev/file/72d494f6c9a48cfaf5a6fcceb97b98cb83c38a73235d7b87eb84d2c4e9e0df4b
Threat name:
ByteCode-MSIL.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2025-12-23 10:22:16 UTC
File Type:
PE (.Net Dll)
AV detection:
4 of 24 (16.67%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=olkjj5wjusgpv5ng7thls64yzob4hcttenoxxb7lqtjmj2pa35fq._file
Result
Malware family:
n/a
Score:
  3/10
Tags:
n/a
Link:
https://tria.ge/reports/251223-nn32eavras/
Unpacked files
SH256 hash:
72d494f6c9a48cfaf5a6fcceb97b98cb83c38a73235d7b87eb84d2c4e9e0df4b
MD5 hash:
c9bebf0b8688ccef820e4c25113489f2
SHA1 hash:
accea060436d2dd24ce121d3cd07dbf9876e9e0f
Link:
https://www.unpac.me/results/def52b0e-0ca5-4e22-a8a8-e5641172102f/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.14
Link:
https://yomi.yoroi.company/submissions/72d494f6c9a48cfaf5a6fcceb97b98cb83c38a73235d7b87eb84d2c4e9e0df4b

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:extracted_at_0x44b
Create hunting rule
Author:cb
Description:sample - file extracted_at_0x44b.exe
Reference:Internal Research
Rule name:NETDLLMicrosoft
Create hunting rule
Author:malware-lu

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/45830/

Comments